Executive brief
SiYuan is a personal knowledge management application that allows users to publish databases to the web with access controls. A flaw in the renderAttributeView function fails to filter sensitive content from related databases, allowing anonymous readers of a published database to access restricted data from linked databases that should be hidden or password-protected. Additionally, when a database's first column is not a document block type, row filtering is bypassed entirely, exposing all content without access checks.
Technical details
This is a missing authorization vulnerability (CWE-862) in the FilterViewByPublishAccess function within SiYuan's publish-mode database rendering. The vulnerability has two distinct flaws: (1) Relation and Rollup cell types carry mirrored content from related attribute views that may reside in hidden, publish-forbidden, or password-protected documents; the filter evaluates only the first cell's document accessibility and returns all other cells' content unchecked, leaking sensitive data from restricted databases; (2) When the first column is not a block-type cell, the accessibility check is skipped entirely and the row is returned unfiltered. Both defects are network-exploitable via POST to /api/av/renderAttributeView in publish mode (default port 6808) without authentication when Publish.Auth.Enable is false. The fix requires evaluating Relation.Contents and Rollup.Contents against publish-access rules and failing closed (dropping the row) when column-0 has no accessible block.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-24: disclosed
- 2026-08-12: advisory
- 2026-: patched: Patched in v3.7.4